Integration/promote to prod

.claude/DECISIONS.md

@@ -0,0 +1,21 @@
+# Decisions
+
+## Legacy migration — incremental patch (2026-08-07)
+
+`prisma/archive.ts` was a one-shot import and cannot see edits, deletions or new
+children of an already-migrated node. `prisma/patch.ts` applies those from a
+`diffdb.sh` diff. Full rationale in
+`apps/modeling-commons-backend/doc/legacy-migration-patch.md`.
+
+- Reusable logic was extracted from `archive.ts` into `prisma/lib/` rather than
+  duplicated, so the patch produces byte-identical keys and rows.
+- The patch is keyed entirely on `legacyId`; no existing row's `id` is touched.
+- Correctness criterion: `archive(baseline) + patch(diff)` must equal
+  `archive(new snapshot)`. Enforced by `prisma/rehearsal/run.sh`.
+- The script refuses to run — rather than guessing — on mid-sequence version
+  deletes, out-of-order version appends, and in-place attachment edits, because
+  `ModelVersion` and `ModelAdditionalFile` carry no legacy id.
+- `updatedAt` is never patched: Prisma's `@updatedAt` overrode it on create, so
+  no migrated row ever held the legacy value.
+- `ModelInteraction` is out of scope: no legacy id, no unique constraint, and
+  `archive.ts` migrated zero rows.

.github/workflows/test-modeling-commons.yml

@@ -63,6 +63,14 @@ jobs:
           restore-keys: |
             node-modules-${{ runner.os }}-
 
+      - name: Assert the beta host is gone
+        run: |
+          if git grep -In "beta\.modelingcommons" -- \
+               ':!doc/' ':!*/doc/' ':!.ongoing/' ':!*/.ongoing/'; then
+            echo "::error::The retired beta host appears at the paths above. The app is served from www.modelingcommons.org; only doc/ and .ongoing/ may still mention it."
+            exit 1
+          fi
+
       - name: Install dependencies
         run: yarn run init
         env:
@@ -154,6 +162,7 @@ jobs:
 
   deploy-staging:
     needs: test
+    if: github.ref == 'refs/heads/staging/modeling-commons'
     uses: ./.github/workflows/build-and-push-modeling-commons.yml
     with:
       environment: modeling-commons-staging

.gitignore

@@ -42,6 +42,6 @@ GITIGNORE_*/**/*
 .env.development
 .env.production
 
-apps/modeling-commons-backend/prisma/archive-output
-apps/modeling-commons-backend/prisma/avatars
+apps/modeling-commons-backend/prisma/legacy-migration/output
+apps/modeling-commons-backend/prisma/legacy-migration/avatars
 .nuxt

apps/modeling-commons-backend/.claude/DECISIONS.md

@@ -0,0 +1,13 @@
+# Decisions
+
+## Entity ids: NanoID instead of UUID
+
+All entity ids switched from `crypto.randomUUID()` to NanoID, generated by `newId()` and validated by `idSchema()` in `src/shared/utils/id.ts`.
+
+- 21 characters, default NanoID alphabet `A-Za-z0-9_-`. Collision probability is negligible at this project's scale, and the alphabet is safe unescaped in URL segments, S3 keys, and JSON.
+- Hard cutover, no transitional dual-accept window: generation and validation switched together. The project is pre-beta, so a shock is acceptable and a permissive "accept both shapes" period would only leave a pattern lying around that something eventually starts depending on.
+- Two deliberate exceptions remain UUID-shaped, each carrying an explaining comment at the source:
+  - `src/shared/utils/validate-request-id.ts` still accepts inbound UUID `x-correlation-id` / `request-id` headers, for interop with upstream proxies and tracing systems that generate UUIDs.
+  - `storagePathHash` in `prisma/legacy-migration/lib/file-keys.ts` is a frozen UUID-shaped hash of a legacy integer id, pinned by test. It is deterministic on purpose; changing its output would orphan existing S3 objects.
+
+Full rationale and inventory: `doc/nanoid-id-migration-plan.md`.

apps/modeling-commons-backend/.gitignore

@@ -0,0 +1,7 @@
+.ongoing/
+prisma/id-migration/output/
+reports/sweep-*.json
+reports/sweep-summary.md
+
+reports/data-integrity-report.json
+reports/data-integrity.html

apps/modeling-commons-backend/AGENTS.md

@@ -35,6 +35,11 @@ Reference modules: `src/modules/model/` (full shape), `src/modules/event/` (read
 - `POST /v1/models/:id/versions` is **multipart/form-data** (required `file` field), not JSON.
 - Draft data persists as versioned JSON validated by compiled Typebox `Parse` (`model-draft/schemas/v1.ts`); its `Clean` step strips properties absent from the schema, so add any new draft field to the schema or it's silently dropped on the next read.
 
+## Ids
+
+- All entity ids are NanoIDs generated by `newId()` from `#src/shared/utils/id.ts`. Never generate an id from Node's native crypto random-identifier call directly.
+- DTOs validate ids with `idSchema(...)` from the same module, never a hand-written regex or a hardcoded format string for the old identifier shape.
+
 ## Routes
 
 - Auth: `preHandler: [requireAuth]` from `#src/shared/hooks/require-auth.ts`.